2

So, doing some testing after seeing a Responder tweet where SMBv2 is supported (https://twitter.com/PythonResponder/status/774236707847704576) and testing a scenario with Windows 7 SMB lookup for an invalid host.

Responder is returning the below:

[SMBv2] NTLMv2-SSP Client   : 192.168.20.123
[SMBv2] NTLMv2-SSP Username : WIN7\User
[SMBv2] NTLMv2-SSP Hash     : User::WIN7:1122334455667788:918C53A0FC0CC877D6B785C8133D9ACD:0101000000000000C0653150DE09D201A9D7C1900B59E56A000000000200080053004D004200330001001E00570049004E002D00500052004800340039003200520051004100460056000400140053004D00420033002E006C006F00630061006C0003003400570049004E002D00500052004800340039003200520051004100460056002E0053004D00420033002E006C006F00630061006C000500140053004D00420033002E006C006F00630061006C0007000800C0653150DE09D201060004000200000008003000300000000000000001000000002000001836D161A44DB8785583E68FEE498FAFC1327F4A1D47BE7F60A537083A1819A80A0010000000000000000000000000000000000009002C0063006900660073002F00730065007200760032002E006C006F00630061006C0064006F006D00610069006E00000000000000000000000000

I know the user password as 'test' and attempt to take to the hash with john with:

john hash.txt --wordlist=pass.txt

(which contains a small list of passwords, including my real password)

John does not successfully crack the hash.

If i take the WebDav response, i can successfully crack the hash:

[HTTP] Sending NTLM authentication request to 192.168.20.123
[HTTP] Host             : serv2 
[WebDAV] NTLMv2 Client   : 192.168.20.123
[WebDAV] NTLMv2 Username : WIN7\User
[WebDAV] NTLMv2 Hash     : User::WIN7:1122334455667788:51F5AFC2AA91C7B5898FBA412C3B6774:010100000000000087D5B0149127D20106530EB5ABDD4926000000000200060053004D0042000100160053004D0042002D0054004F004F004C004B00490054000400120073006D0062002E006C006F00630061006C000300280073006500720076006500720032003000300033002E0073006D0062002E006C006F00630061006C000500120073006D0062002E006C006F00630061006C0008003000300000000000000001000000002000001836D161A44DB8785583E68FEE498FAFC1327F4A1D47BE7F60A537083A1819A80A0010000000000000000000000000000000000009002C0048005400540050002F00730065007200760032002E006C006F00630061006C0064006F006D00610069006E000000000000000000

Any advice? What am I missing here?

Thanks

7
  • john understands the password file format like a /etc/passwd on *nix machines. How does your hash.txt looks like?
    – grochmal
    Commented Oct 17, 2016 at 9:35
  • Hash.txt basically contains the ntlmv2 ssp hash line. It is generated by Responder into the logs directory.
    – TheITGuy
    Commented Oct 17, 2016 at 9:52
  • It seems to understand the hash, as does hashcrack. Both run without error, but advise of no cracked hashes as a result.
    – TheITGuy
    Commented Oct 17, 2016 at 10:10
  • hmm... you're right, that is the right format for NTMLv2. Yet, I wonder, how the 'account" part was provided to the hash. Maybe it was not given as User::WIN7 but as WIN7/User
    – grochmal
    Commented Oct 17, 2016 at 10:31
  • Are you suspecting a Responder issue?
    – TheITGuy
    Commented Oct 18, 2016 at 2:23

1 Answer 1

4

This issue has been fixed in the latest release (2.3.3.1).

The challenge sent was not the one displayed.

In the future, please take the time to send us a bug report on github: https://github.com/lgandx/Responder

We'll fix it asap.

Thanks!

2
  • Heh, it was a bug after all. Here is the direct link to the diff. It was hard to debug, I should have seen that the challenge does not match :). Great work in fixing it within a day.
    – grochmal
    Commented Oct 18, 2016 at 17:10
  • :) thanks! I would have raised a bug but thought I was missing something. Great work! Thanks
    – TheITGuy
    Commented Oct 18, 2016 at 19:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .